Borrowing it
Nothing to install: this file belongs to dundas/thinkrun. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dundas/thinkrun/main/.claude/skills/before-after/SKILL.mdgit clone --depth 1 https://github.com/dundas/thinkrunWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dundas/thinkrun/before-after)<a href="https://agentmods.dev/skills/dundas/thinkrun/before-after"><img src="https://agentmods.dev/badge/skills/dundas/thinkrun/before-after/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dundas/thinkrun/before-after"><img src="https://agentmods.dev/badge/skills/dundas/thinkrun/before-after.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00142 | $0.02182 |
| Opus 5.5 | $0.00057 | $0.00873 |
| Sonnet 5.5 | $0.00028 | $0.00436 |
| Haiku 4.5 | $0.00014 | $0.00218 |
Grade A, and why
before-after scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Before / After
One job: a reviewer opens the PR and sees, side by side, what the surface looked like before the change and after it. Same page, same viewport, same element. Two images and one line of what changed. Nothing else.
This is not proof that the change works — that is prove-it, and the two
share captures: if prove-it already produced PNGs, reuse them.
Inputs
- What to capture: a URL, optionally narrowed to a selector (
--selector) for a component-level shot, or--full-pagefor the whole page. - Before source (one of): the base revision running somewhere; a previous deployment URL; an existing PNG.
- After source: the change under test, running; or an existing PNG.
- PR number (optional): where the table goes.
Step 0 — Doctor, mode, target
Already have both PNGs? Skip to "Reusing existing PNGs" at the end — no
browser, no doctor, no session. Everything in Steps 0–2 exists to produce
the two images.
thinkrun doctor
Local mode for anything behind login or on localhost; cloud mode for public
URLs with no display (cloud browsers cannot reach your localhost). (Cloud path: command surface verified against CLI 0.1.37; not smoke-tested
when this skill shipped — a session-provisioning incident on 2026-09-18.)
Run exactly one of the two blocks.
Local (behind login, or localhost):
# open your OWN window. A capture needs the tab visible; on a shared machine another
# agent's window can be in front, and Chrome returns "image readback failed" for a hidden tab.
TAB_ID=$(thinkrun new-window "about:blank" --json | jq -er .data.tabId) || exit 1; T="--tab $TAB_ID"
visible() { [ "$(thinkrun evaluate 'document.visibilityState' $T --json | jq -r .data)" = "visible" ] || { echo "tab is hidden; bring the window forward and retake"; exit 1; }; }
same_session() { :; }
Cloud (public URL, no display):
SID=$(thinkrun cloud start --json | jq -er .data.sessionId) || exit 1; T="--mode cloud"
trap 'thinkrun cloud stop -s "$SID" >/dev/null 2>&1' EXIT # stops THIS session, never whatever is active
# the active cloud session is machine-wide state; there is no per-command session flag,
# so assert it before every navigate and capture:
same_session() { [ "$(thinkrun cloud status --json | jq -r .data.sessionId)" = "$SID" ] || { echo "active cloud session changed; stop"; exit 1; }; }
visible() { [ "$(thinkrun evaluate 'document.visibilityState' $T --json | jq -r .data)" = "visible" ] || { echo "tab is hidden; retake"; exit 1; }; }
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 199 lines · 142 tokens per session scan A 21a594b67ced
before-after is a skill published in the GitHub repository dundas/thinkrun (2 stars, last pushed 18d ago), licensed MIT. It adds 142 tokens to every session and 2,182 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-22.
Other skills, from other repositories
Agent Browser Automation
Fast Rust-based headless browser automation CLI with Node.js fallback for AI agents, featuring navigation, clicking, typing, snapshots, and structured commands optimized for agent workflows.
Browser-Use Automation
CLI tool for persistent browser automation with multi-session support, featuring Chromium/Real/Remote browser modes, cookie management, JavaScript execution, and long-running automation workflows.
real-browser-control
Connect an AI coding agent to the user's REAL Chrome via Real Browser MCP (local MCP server + Chrome extension over localhost WebSocket). Use for live UI verification, already-open tabs, existing cookies/SSO/2FA, staging admin panels, and any task where headless Playwright or a cloud agentic browser would miss the…
browser-automation
Control the user's real logged-in Chrome via Real Browser MCP (extension + local MCP). Use for live UI checks, existing SSO/cookies, and tabs already open. Triggers: real browser, my Chrome, not headless, verify in browser. Prefer over Playwright when session state matters. Prefer Playwright for CI.
browseweave
Use when installing, repairing, verifying, diagnosing, or safely operating the BrowseWeave systemd-based Linux developer preview with Chrome, Zen, or Firefox and a local MCP client. Do not use for store publication or bypassing site protections.
electron
Automate Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify, etc.) using agent-browser via Chrome DevTools Protocol. Use when the user needs to interact with an Electron app, automate a desktop app, connect to a running app, control a native app, or test an Electron application. Triggers include…